RehhcSSDT
ServiceMain
winsafe
Behavioral task
behavioral1
Sample
fae171cd84451efb4937252f52ffe2b1_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fae171cd84451efb4937252f52ffe2b1_JaffaCakes118
Size
316KB
MD5
fae171cd84451efb4937252f52ffe2b1
SHA1
da6cc08b73604ead918b78b2dd0ff92a9d5ce9f7
SHA256
54c3d297bff6c1dfc52934152b424d19c44e8a3a6c40ebee0abcf3e658d19ca2
SHA512
b0f06e926f499a2eb280f7ccb77d6f51a6fd678b6ea10ac2ca16692a2fd2a5b511179568e348a370ab43245aef9c395a1667308a483ee499f78f8b25a4f68333
SSDEEP
6144:z6cPpODxCdS7eOUQ418/P676Go6FGwbqydWLTrSYTvCV+CP7fVc:zVcCEn6764FNdwDTvCVL7fi
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
fae171cd84451efb4937252f52ffe2b1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RehhcSSDT
ServiceMain
winsafe
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ